CVE-2025-53967
🟡 Monitoruj
W Framelink Figma MCP Server występuje luka umożliwiająca zdalne wykonanie poleceń przez atakującego.
CVSS
8.0
EPSS
5.8%
Exploit
none
Vendor
Opis źródłowy (NVD)
Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable endpoint fails to properly sanitize user-supplied input, enabling the attacker to inject malicious commands that are executed with the privileges of the MCP process. Exploitation requires network access to the MCP interface.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 8.0 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 5.8% |
| Opublikowano (NVD) | 2025-10-08 17:15:34 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-08 13:10:00 UTC |
Referencje
- https://github.com/GLips/Figma-Context-MCP/blob/96b3852669c5eed65e4a6e20406c25504d9196f2/src/utils/fetch-with-retry.ts#L34 ([email protected])
- https://github.com/GLips/Figma-Context-MCP/releases/tag/v0.6.3 ([email protected])
- https://www.imperva.com/blog/another-critical-rce-discovered-in-a-popular-mcp-server/ ([email protected])